@docker-doctor/cli 0.6.0 → 0.7.0

package/dist/index.cjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_src = require('./src-BpAv-H0Z.cjs');
+const require_src = require('./src-DiT93yVt.cjs');
 
 //#region ../core/src/config/define-config.ts
 const defineConfig = (config) => config;

package/dist/index.d.cts

@@ -74,7 +74,7 @@ export declare const defineConfig: (config: DockerDoctorConfig) => DockerDoctorC
 export declare const loadConfig: (rootDir: string, customPath?: string, onWarning?: (message: string) => void) => Promise<DockerDoctorConfig>;
 //#endregion
 //#region ../core/src/scoring.d.ts
-export declare const calculateScore: (diagnostics: Diagnostic[]) => {
+export declare const calculateScore: (diagnostics: Diagnostic[], analyzedFileCount?: number) => {
   score: number;
   label: string;
 };

package/dist/index.d.mts

@@ -74,7 +74,7 @@ export declare const defineConfig: (config: DockerDoctorConfig) => DockerDoctorC
 export declare const loadConfig: (rootDir: string, customPath?: string, onWarning?: (message: string) => void) => Promise<DockerDoctorConfig>;
 //#endregion
 //#region ../core/src/scoring.d.ts
-export declare const calculateScore: (diagnostics: Diagnostic[]) => {
+export declare const calculateScore: (diagnostics: Diagnostic[], analyzedFileCount?: number) => {
   score: number;
   label: string;
 };

package/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { a as runDockerfileRules, d as discoverProject, f as version$1, i as runComposeRules, l as parseCompose, n as calculateScore, o as allRules, r as loadConfig, s as findRule, t as toJsonReport, u as parseDockerfile } from "./src-BLeXr_hR.mjs";
+import { a as runDockerfileRules, d as discoverProject, f as version$1, i as runComposeRules, l as parseCompose, n as calculateScore, o as allRules, r as loadConfig, s as findRule, t as toJsonReport, u as parseDockerfile } from "./src-D2DWrv5B.mjs";
 
 //#region ../core/src/config/define-config.ts
 const defineConfig = (config) => config;

package/dist/{src-BLeXr_hR.mjs → src-D2DWrv5B.mjs}

@@ -2,9 +2,10 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { LineCounter, isAlias, isMap, isScalar, isSeq, parse, parseDocument } from "yaml";
+import { pathToFileURL } from "node:url";
 
 //#region package.json
-var version = "0.6.0";
+var version = "0.7.0";
 
 //#endregion
 //#region ../core/src/project-info/ignore.ts
@@ -44,6 +45,17 @@ const globToRegExp = (pattern) => {
 	}
 	return new RegExp(`${source}$`, "u");
 };
+const LEADING_DOT_SLASH_RE = /^(?:\.\/)+/u;
+/**
+* Accepts two spellings people bring from `.gitignore`. A leading `./` is
+* dropped because patterns are already root-relative, and a trailing `/`
+* means the whole directory. `vendor/` and `./vendor/**` both become
+* `vendor/**`.
+*/
+const normalizeIgnorePattern = (pattern) => {
+	const rootRelative = pattern.replace(LEADING_DOT_SLASH_RE, "");
+	return rootRelative.endsWith("/") ? `${rootRelative}**` : rootRelative;
+};
 /**
 * Builds a predicate over root-relative paths from `ignore.files`
 * patterns. Windows separators in the tested path are normalized to `/`
@@ -51,7 +63,7 @@ const globToRegExp = (pattern) => {
 */
 const createIgnoreMatcher = (patterns) => {
 	if (!patterns || patterns.length === 0) return () => false;
-	const regexps = patterns.map(globToRegExp);
+	const regexps = patterns.map(normalizeIgnorePattern).map(globToRegExp);
 	return (relativePath) => {
 		const normalized = relativePath.replaceAll("\\", "/");
 		return regexps.some((regexp) => regexp.test(normalized));
@@ -88,7 +100,7 @@ const PRUNED_DIRECTORIES = [
 const PRUNED = new Set(PRUNED_DIRECTORIES);
 const toPosixRelative = (rootDir, file) => path.relative(rootDir, file).split(path.sep).join("/");
 const SUBTREE_SUFFIX = "/**";
-const createPrunedDirectoryMatcher = (patterns = []) => createIgnoreMatcher(patterns.filter((pattern) => pattern.endsWith(SUBTREE_SUFFIX)).map((pattern) => pattern.slice(0, -3)));
+const createPrunedDirectoryMatcher = (patterns = []) => createIgnoreMatcher(patterns.map(normalizeIgnorePattern).filter((pattern) => pattern.endsWith(SUBTREE_SUFFIX)).map((pattern) => pattern.slice(0, -3)));
 const isPermissionError = (error) => error instanceof Error && "code" in error && (error.code === "EACCES" || error.code === "EPERM");
 const walk = async (dir, options, fileList = []) => {
 	let files;
@@ -236,7 +248,7 @@ const HEREDOC_INSTRUCTIONS = /* @__PURE__ */ new Set([
 	"RUN"
 ]);
 const INSTRUCTION_LINE_RE = /^(?<inst>[A-Za-z]+)\s+(?<args>.*)$/u;
-const HEREDOC_OPENER_RE = /(?<=^|\s)<<-?(?<quote>['"]?)(?<delim>\w+)\k<quote>/gu;
+const HEREDOC_OPENER_RE = /(?<=^|\s)<<-?(?<quote>['"]?)(?<delim>[^\s'"<>;&|()]+)\k<quote>/gu;
 const createParserState = () => ({
 	currentArgs: "",
 	currentInstruction: "",
@@ -383,7 +395,7 @@ const parseExecForm = (args) => {
 //#endregion
 //#region ../core/src/parsers/image-ref.ts
 const parseImageRef = (ref) => {
-	if (ref.includes("${") || ref.startsWith("$")) return {
+	if (ref.includes("$")) return {
 		isVariable: true,
 		name: ref
 	};
@@ -435,6 +447,15 @@ const isHardenedRuntimeImage = (imagePart) => {
 	const { tag } = parseImageRef(imagePart);
 	return !(tag === "dev" || tag?.endsWith("-dev"));
 };
+const DISTROLESS_NONROOT_TAG_RE = /(?:^|-)nonroot(?:-|$)/u;
+/**
+* Distroless images tagged `nonroot` (also `debug-nonroot` and the
+* per-architecture `nonroot-amd64` forms) run as uid 65532.
+*/
+const isDistrolessNonroot = (imagePart) => {
+	const { name, registry, tag } = parseImageRef(imagePart);
+	return registry === "gcr.io" && name.startsWith("distroless/") && tag !== void 0 && DISTROLESS_NONROOT_TAG_RE.test(tag);
+};
 /**
 * Why a reference would resolve differently over time: no tag at all, or
 * the mutable `latest` tag without a digest. `undefined` means the ref is
@@ -464,6 +485,11 @@ const collectStageAliases = (instructions) => {
 	return aliases;
 };
 
+//#endregion
+//#region ../core/src/parsers/run-flags.ts
+const LEADING_RUN_FLAGS_RE = /^(?:--[a-z][a-z-]*(?:=\S*)?\s+)+/u;
+const stripRunFlags = (args) => args.replace(LEADING_RUN_FLAGS_RE, "");
+
 //#endregion
 //#region ../core/src/rules/create-diagnostic.ts
 const createDiagnostic = (file, ruleKey, severity, message, help, line) => ({
@@ -607,12 +633,14 @@ const usePipefail = {
 	key: "docker-doctor/use-pipefail",
 	message: "Use pipefail to catch pipeline command failures"
 };
+const SURROUNDING_QUOTES_RE$1 = /^(?<quote>["'])(?<inner>.*)\k<quote>$/u;
 const absoluteWorkdir = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "WORKDIR") {
-			const path = inst.args.trim();
+			const trimmed = inst.args.trim();
+			const path = trimmed.match(SURROUNDING_QUOTES_RE$1)?.groups?.inner ?? trimmed;
 			if (!/^(?:\/|\\|\$|[a-zA-Z]:)/u.test(path)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `WORKDIR specifies a relative path '${path}'. For clarity and reliability, always use absolute paths.`, this.help, inst.line));
 		}
 		return diagnostics;
@@ -626,7 +654,7 @@ const avoidRunCd = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "RUN" && CD_COMMAND_RE.test(maskQuotedText(inst.args))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.", this.help, inst.line));
+		for (const inst of instructions) if (inst.instruction === "RUN" && CD_COMMAND_RE.test(maskQuotedText(stripRunFlags(inst.args)))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.", this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "info",
@@ -637,11 +665,13 @@ const avoidRunCd = {
 const PACKAGE_LIST_START_RE = /\b(?:apt-get(?:\s+-\S+)*\s+install|apk\s+add|yum\s+install|dnf\s+install)\b/u;
 const SHELL_SEPARATOR_RE$1 = /[;|]|&&/u;
 const WHITESPACE_RE$1 = /\s+/u;
+const UNCONTINUED_NEWLINE_RE = /(?<!\\[ \t]*)\r?\n/u;
 const collectPackageList = (raw) => {
 	const start = PACKAGE_LIST_START_RE.exec(raw);
 	if (!start) return [];
 	const packages = [];
-	const tokens = raw.slice(start.index + start[0].length).split(WHITESPACE_RE$1);
+	const [command] = raw.slice(start.index + start[0].length).split(UNCONTINUED_NEWLINE_RE);
+	const tokens = command.split(WHITESPACE_RE$1);
 	for (const token of tokens) {
 		if (SHELL_SEPARATOR_RE$1.test(token)) break;
 		if (token !== "" && token !== "\\" && !token.startsWith("-")) packages.push(token);
@@ -671,15 +701,18 @@ const sortMultilineArgs = {
 	key: "docker-doctor/sort-multiline-args",
 	message: "Sort multi-line arguments alphanumerically"
 };
+const USERADD_COMMAND_RE = /\buseradd\b/u;
+const NO_LOG_INIT_FLAG_RE = /(?:^|\s)(?:--no-log-init|-[A-Za-z]*l[A-Za-z]*)(?=\s|$)/u;
+const useraddWritesLoginLogs = (args) => args.split(SHELL_SEPARATOR_RE$1).some((command) => USERADD_COMMAND_RE.test(command) && !NO_LOG_INIT_FLAG_RE.test(command));
 const useraddNoLogInit = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "RUN" && /\buseradd\b/u.test(inst.args) && !inst.args.includes("--no-log-init")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN instruction runs 'useradd' without '--no-log-init'. This can cause excessive disk space usage / exhaustion under Go's sparse tar archive bug when large UIDs are used.", this.help, inst.line));
+		for (const inst of instructions) if (inst.instruction === "RUN" && useraddWritesLoginLogs(inst.args)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN instruction runs 'useradd' without '--no-log-init'. This can cause excessive disk space usage / exhaustion under Go's sparse tar archive bug when large UIDs are used.", this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Pass `--no-log-init` flag to useradd (e.g., `RUN useradd --no-log-init -r -g mygroup myuser`).",
+	help: "Pass `--no-log-init` or its short form `-l` to useradd (e.g., `RUN useradd --no-log-init -r -g mygroup myuser`).",
 	key: "docker-doctor/useradd-no-log-init",
 	message: "Use --no-log-init with useradd"
 };
@@ -698,6 +731,13 @@ const bestPracticesRules = [
 
 //#endregion
 //#region ../core/src/rules/compose-services.ts
+const TRUE_SPELLINGS = /* @__PURE__ */ new Set([
+	"true",
+	"y",
+	"yes",
+	"on"
+]);
+const isComposeTrue = (value) => value === true || typeof value === "string" && TRUE_SPELLINGS.has(value.trim().toLowerCase());
 /**
 * Narrows an unknown compose document to its service entries. A service
 * with a null body (`web:` with nothing under it) is returned as an empty
@@ -964,7 +1004,7 @@ const volumeMount = (volume) => {
 	if (volume && typeof volume === "object") {
 		const { read_only: readOnly, source, target, type } = volume;
 		return {
-			readOnly: readOnly === true,
+			readOnly: isComposeTrue(readOnly),
 			source: typeof source === "string" ? source : void 0,
 			target: typeof target === "string" ? target : void 0,
 			type: typeof type === "string" ? type : void 0
@@ -1049,12 +1089,14 @@ const SECRET_KEY_PATTERNS = [
 	/(?:^|[_-])auth(?:[_-]|$)/iu,
 	/(?:^|[_-])pat(?:[_-]|$)/iu
 ];
-const isSecretKey = (key) => SECRET_KEY_PATTERNS.some((regex) => regex.test(key));
+const SECRET_LOCATION_SUFFIX = /[_-](?:file|path)$/iu;
+const isSecretKey = (key) => !SECRET_LOCATION_SUFFIX.test(key) && SECRET_KEY_PATTERNS.some((regex) => regex.test(key));
 const CREDENTIAL_FREE_URL = /^[a-z][a-z0-9+.-]*:\/\/[^@/\s]*(?:\/|$)/iu;
+const SWITCH_VALUE = /^(?:true|false|yes|no|on|off)$/iu;
 const SURROUNDING_QUOTES_RE = /^(?<quote>["'])(?<inner>.*)\k<quote>$/su;
 const isLiteralSecretValue = (value) => {
 	const unquoted = value.match(SURROUNDING_QUOTES_RE)?.groups?.inner ?? value;
-	return unquoted.length > 0 && !unquoted.startsWith("$") && !CREDENTIAL_FREE_URL.test(unquoted);
+	return unquoted.length > 0 && !unquoted.startsWith("$") && !SWITCH_VALUE.test(unquoted) && !CREDENTIAL_FREE_URL.test(unquoted);
 };
 
 //#endregion
@@ -1063,7 +1105,7 @@ const noPrivilegedService = {
 	category: "Compose",
 	check(composeContent, file, context) {
 		const diagnostics = [];
-		for (const [name, config] of composeServices(composeContent)) if (config.privileged === true) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' runs in privileged mode. A privileged container has full access to the host's devices and kernel, so compromising this service compromises the host.`, this.help, context?.locate?.([
+		for (const [name, config] of composeServices(composeContent)) if (isComposeTrue(config.privileged)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' runs in privileged mode. A privileged container has full access to the host's devices and kernel, so compromising this service compromises the host.`, this.help, context?.locate?.([
 			"services",
 			name,
 			"privileged"
@@ -1215,13 +1257,56 @@ const composeSecurityRules = [
 
 //#endregion
 //#region ../core/src/rules/image-size.ts
+const NODE_ENV_ASSIGNMENT_RE = /(?:^|\s)NODE_ENV(?:=|\s+)["']?(?<value>[^\s"']*)/u;
+const collectStages = (instructions) => {
+	const stages = [];
+	const productionEnv = [];
+	for (const inst of instructions) if (inst.instruction === "FROM") {
+		const { base, stage } = parseFromArgs(inst.args);
+		const baseKey = base?.toLowerCase() ?? "";
+		const parent = stages.findIndex((s) => s.name !== null && s.name === baseKey);
+		productionEnv.push(parent !== -1 && productionEnv[parent]);
+		stages.push({
+			base: baseKey,
+			from: inst,
+			name: stage?.toLowerCase() ?? null,
+			runs: []
+		});
+	} else if (inst.instruction === "ENV" && stages.length > 0) {
+		const value = NODE_ENV_ASSIGNMENT_RE.exec(inst.args)?.groups?.value;
+		if (value !== void 0) productionEnv[stages.length - 1] = value === "production";
+	} else if (inst.instruction === "RUN" && stages.length > 0 && !productionEnv[stages.length - 1]) stages.at(-1)?.runs.push(inst);
+	return stages;
+};
+const shippedStages = (stages) => {
+	const shipped = [];
+	let index = stages.length - 1;
+	while (index >= 0) {
+		shipped.unshift(stages[index]);
+		const { base } = stages[index];
+		index = stages.slice(0, index).findIndex((s) => s.name !== null && s.name === base);
+	}
+	return shipped;
+};
+const MINIMAL_BASE_MARKERS = [
+	"alpine",
+	"slim",
+	"distroless",
+	"busybox",
+	"chainguard",
+	"wolfi",
+	"chiseled",
+	"minideb",
+	"nanoserver"
+];
+const MINIMAL_BASE_SEGMENT_RE = /(?:^|[/_. -])(?:minimal|micro)(?:$|[/_. -])/u;
 const preferSlimBase = {
 	category: "Image Size",
 	check(instructions, file) {
 		const diagnostics = [];
 		const stageAliases = collectStageAliases(instructions);
-		for (const inst of instructions) if (inst.instruction === "FROM") {
-			const imagePart = parseFromArgs(inst.args).base;
+		for (const { from } of shippedStages(collectStages(instructions))) {
+			const imagePart = parseFromArgs(from.args).base;
 			if (!imagePart || isScratch(imagePart)) continue;
 			const ref = parseImageRef(imagePart);
 			if (ref.isVariable || stageAliases.has(imagePart.toLowerCase())) continue;
@@ -1229,7 +1314,7 @@ const preferSlimBase = {
 			if (ref.digest) continue;
 			if (!ref.tag) continue;
 			const haystack = `${ref.name} ${ref.tag}`.toLowerCase();
-			if (!(haystack.includes("alpine") || haystack.includes("slim") || haystack.includes("distroless") || haystack.includes("busybox"))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' may be a full-OS distribution. Consider using a slim or alpine alternative.`, this.help, inst.line));
+			if (!(MINIMAL_BASE_MARKERS.some((marker) => haystack.includes(marker)) || MINIMAL_BASE_SEGMENT_RE.test(haystack))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' may be a full-OS distribution. Consider using a slim or alpine alternative.`, this.help, from.line));
 		}
 		return diagnostics;
 	},
@@ -1241,6 +1326,8 @@ const preferSlimBase = {
 const BUILDKIT_MOUNT_FLAG_RE = /--mount=(?<spec>\S+)/gu;
 const CACHE_TARGET_KEY_RE = /^(?:target|dst|destination)=/u;
 const cacheMountTargets = (args) => [...args.matchAll(BUILDKIT_MOUNT_FLAG_RE)].map((match) => (match.groups?.spec ?? "").split(",")).filter((options) => options.includes("type=cache")).flatMap((options) => options.filter((option) => CACHE_TARGET_KEY_RE.test(option)).map((option) => option.slice(option.indexOf("=") + 1)));
+const RECURSIVE_RM_RE = /\brm\s+(?:-[A-Za-z]+\s+)*-[A-Za-z]*[rR][A-Za-z]*\s(?<operands>[^;&|]*)/gu;
+const removesRecursively = (args, dir) => [...args.matchAll(RECURSIVE_RM_RE)].some((match) => (match.groups?.operands ?? "").includes(dir));
 const APT_CACHE_DIRS = ["/var/lib/apt", "/var/cache/apt"];
 const APK_CACHE_DIRS = ["/var/cache/apk", "/etc/apk/cache"];
 const hasCacheMountFor = (args, cacheDirs) => cacheMountTargets(args).some((target) => cacheDirs.some((dir) => target === dir || target.startsWith(`${dir}/`)));
@@ -1250,8 +1337,8 @@ const cleanPackageCache = {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "RUN") {
 			const { args } = inst;
-			if (hasAptGetInstall(args) && !args.includes("rm -rf /var/lib/apt/lists") && !hasCacheMountFor(args, APT_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apt-get install' without removing package lists afterwards. This keeps metadata caches inside the image layer.`, this.help, inst.line));
-			if (args.includes("apk add") && !args.includes("--no-cache") && !args.includes("rm -rf /var/cache/apk") && !hasCacheMountFor(args, APK_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apk add' without '--no-cache' or cleaning the apk cache. This increases layer size.`, this.help, inst.line));
+			if (hasAptGetInstall(args) && !removesRecursively(args, "/var/lib/apt/lists") && !hasCacheMountFor(args, APT_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apt-get install' without removing package lists afterwards. This keeps metadata caches inside the image layer.`, this.help, inst.line));
+			if (args.includes("apk add") && !args.includes("--no-cache") && !removesRecursively(args, "/var/cache/apk") && !hasCacheMountFor(args, APK_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apk add' without '--no-cache' or cleaning the apk cache. This increases layer size.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -1278,6 +1365,7 @@ const NON_DEV_INSTALL_FLAGS = /* @__PURE__ */ new Set([
 	"-g",
 	"--global",
 	"--production",
+	"--production=true",
 	"--omit=dev",
 	"--only=prod",
 	"--only=production",
@@ -1293,36 +1381,17 @@ const segmentInstallsDevDependencies = (segment) => {
 	if (!(NODE_PACKAGE_MANAGERS.has(manager) && INSTALL_VERBS.has(verb))) return false;
 	return !tokens.slice(0, commandStart).includes("NODE_ENV=production") && options.every((option) => option.startsWith("-") && !NON_DEV_INSTALL_FLAGS.has(option));
 };
-const installsDevDependencies = (args) => !args.includes("prune") && maskQuotedText(args).split(SHELL_SEPARATOR_RE).some(segmentInstallsDevDependencies);
+const installsDevDependencies = (args) => !args.includes("prune") && maskQuotedText(stripRunFlags(args)).split(SHELL_SEPARATOR_RE).some(segmentInstallsDevDependencies);
 const avoidDevDependencies = {
 	category: "Image Size",
 	check(instructions, file) {
 		const diagnostics = [];
-		const stages = [];
-		for (const inst of instructions) if (inst.instruction === "FROM") {
-			const { base, stage } = parseFromArgs(inst.args);
-			stages.push({
-				base: base?.toLowerCase() ?? "",
-				name: stage?.toLowerCase() ?? null,
-				runs: []
-			});
-		} else if (inst.instruction === "RUN" && stages.length > 0) stages.at(-1)?.runs.push(inst);
-		if (stages.length === 0) return diagnostics;
-		const auditedIndices = [];
-		let index = stages.length - 1;
-		while (index >= 0) {
-			auditedIndices.push(index);
-			const { base } = stages[index];
-			index = stages.slice(0, index).findIndex((s) => s.name !== null && s.name === base);
-		}
-		const finalIndex = stages.length - 1;
-		for (const stageIndex of auditedIndices.toReversed()) {
-			const stage = stages[stageIndex];
-			for (const inst of stage.runs) {
-				if (!installsDevDependencies(inst.args)) continue;
-				const where = stageIndex === finalIndex ? "in the final stage" : `in stage '${stage.name}', whose layers the final stage inherits,`;
-				diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running package install '${inst.args}' ${where} without omitting devDependencies.`, this.help, inst.line));
-			}
+		const stages = collectStages(instructions);
+		const finalStage = stages.at(-1);
+		for (const stage of shippedStages(stages)) for (const inst of stage.runs) {
+			if (!installsDevDependencies(inst.args)) continue;
+			const where = stage === finalStage ? "in the final stage" : `in stage '${stage.name}', whose layers the final stage inherits,`;
+			diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running package install '${inst.args}' ${where} without omitting devDependencies.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -1344,7 +1413,7 @@ const useMultiStage = {
 	category: "Performance",
 	check(instructions, file) {
 		if (instructions.filter((inst) => inst.instruction === "FROM").length === 1) {
-			if (instructions.some((inst) => inst.instruction === "RUN" && (inst.args.includes("npm run build") || inst.args.includes("yarn build") || inst.args.includes("bun run build") || inst.args.includes("cargo build") || BUILD_TOOL_COMMAND_RE.test(maskQuotedText(inst.args))))) return [createDiagnostic(file, this.key, this.defaultSeverity, "Only one build stage (FROM) was detected, but build instructions were found. Multi-stage builds can significantly reduce final image size.", this.help, instructions.find((inst) => inst.instruction === "FROM")?.line || 1)];
+			if (instructions.some((inst) => inst.instruction === "RUN" && (inst.args.includes("npm run build") || inst.args.includes("yarn build") || inst.args.includes("bun run build") || inst.args.includes("cargo build") || BUILD_TOOL_COMMAND_RE.test(maskQuotedText(stripRunFlags(inst.args)))))) return [createDiagnostic(file, this.key, this.defaultSeverity, "Only one build stage (FROM) was detected, but build instructions were found. Multi-stage builds can significantly reduce final image size.", this.help, instructions.find((inst) => inst.instruction === "FROM")?.line || 1)];
 		}
 		return [];
 	},
@@ -1447,7 +1516,7 @@ const noRootUser = {
 		let lastUserLine = 1;
 		for (const inst of instructions) if (inst.instruction === "FROM") {
 			const { base, stage } = parseFromArgs(inst.args);
-			const baseDefaultUser = base && isHardenedRuntimeImage(base) ? "nonroot" : "root";
+			const baseDefaultUser = base && (isHardenedRuntimeImage(base) || isDistrolessNonroot(base)) ? "nonroot" : "root";
 			lastUser = stageUser.get(base?.toLowerCase() ?? "") ?? baseDefaultUser;
 			lastUserLine = inst.line;
 			currentStage = stage?.toLowerCase() ?? null;
@@ -1526,14 +1595,16 @@ const noAddRemote = {
 	check(instructions, file) {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "ADD") {
-			const src = inst.args.split(/\s+/u).find((p) => !p.startsWith("--"));
-			if (!src) continue;
+			const parts = inst.args.split(/\s+/u);
+			const src = parts.find((p) => !p.startsWith("--"));
+			const isVerified = parts.some((p) => p.startsWith("--checksum="));
+			if (!src || isVerified) continue;
 			if (src.startsWith("http://") || src.startsWith("https://")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `ADD instruction uses a remote URL '${src}'. Remote files added via ADD cannot be cleaned up in later layers, increasing image size.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Use `RUN curl` or `RUN wget` instead of ADD for remote URLs, and delete the downloaded archive in the same layer to minimize size.",
+	help: "Add `--checksum=sha256:<digest>` so BuildKit verifies the download, or use `RUN curl` or `RUN wget` and delete the downloaded archive in the same layer to minimize size.",
 	key: "docker-doctor/no-add-remote",
 	message: "Avoid using ADD with remote URLs"
 };
@@ -1717,7 +1788,7 @@ const importConfig = async (filePath) => {
 	if (filePath.endsWith(".json")) return parseConfigFile(filePath, "JSON", JSON.parse);
 	if (filePath.endsWith(".yaml") || filePath.endsWith(".yml")) return parseConfigFile(filePath, "YAML", parse);
 	try {
-		const configModule = await import(filePath);
+		const configModule = await import(pathToFileURL(filePath).href);
 		return configModule.default || configModule;
 	} catch (error) {
 		const reason = typeStrippingFailure(filePath, error);
@@ -1801,11 +1872,15 @@ const getScoreBucket = (score) => {
 	for (const bucket of SCORE_BUCKETS) if (score >= bucket.min) return bucket;
 	return SCORE_BUCKETS.at(-1);
 };
-const calculateScore = (diagnostics) => {
-	let penalty = 0;
-	for (const diag of diagnostics) if (diag.severity === "error") penalty += 10;
-	else if (diag.severity === "warning") penalty += 4;
-	else if (diag.severity === "info") penalty += 1;
+const SEVERITY_PENALTY = {
+	error: 10,
+	info: 1,
+	warning: 4
+};
+const calculateScore = (diagnostics, analyzedFileCount = 1) => {
+	let totalPenalty = 0;
+	for (const diag of diagnostics) totalPenalty += SEVERITY_PENALTY[diag.severity];
+	const penalty = totalPenalty / Math.max(1, analyzedFileCount);
 	const score = Math.round(100 * Math.exp(-penalty / 70));
 	const bucket = getScoreBucket(score);
 	return {
@@ -1816,7 +1891,7 @@ const calculateScore = (diagnostics) => {
 
 //#endregion
 //#region ../core/src/report.ts
-const REPORT_SCHEMA_VERSION = 4;
+const REPORT_SCHEMA_VERSION = 5;
 const resolveCategory = (diagnostic) => {
 	const category = diagnostic.category ?? findRule(diagnostic.rule)?.category;
 	if (!category) throw new Error(`Diagnostic for unknown rule "${diagnostic.rule}" has no category`);
@@ -1839,11 +1914,11 @@ const toJsonReport = (diagnostics, score, label, project, failures = []) => ({
 	})),
 	label,
 	project,
-	schemaVersion: 4,
+	schemaVersion: 5,
 	score,
 	timestamp: (/* @__PURE__ */ new Date()).toISOString()
 });
 
 //#endregion
 export { runDockerfileRules as a, createComposeLocator as c, discoverProject as d, version as f, runComposeRules as i, parseCompose as l, calculateScore as n, allRules as o, loadConfig as r, findRule as s, toJsonReport as t, parseDockerfile as u };
-//# sourceMappingURL=src-BLeXr_hR.mjs.map
+//# sourceMappingURL=src-D2DWrv5B.mjs.map